now hashes passwords with bcrypt